Before shutdown, Megaupload ate up more corporate bandwidth than Dropbox

Before being shut down by the feds today over copyright infringement …

Before being shut down by the feds today, the file-sharing site Megaupload was extraordinarily popular with home Internet users—so much so that the file downloading habit was spilling over into the workplace in a significant way.

The shutdown of the site—and the arrests of four of Megaupload's leaders today in New Zealand—are bound to have major consequences in the file sharing market. Although Megaupload's presence in the corporate world may not have matched its overall share of Internet usage, its consumption of bandwidth was outpacing Dropbox and numerous other business-focused file-sharing services, according to a new study. BitTorrent is also quite popular in the workplace, and some people are even installing Tor clients on their work machines to conceal details of their Internet usage, the study found.

The data comes from security vendor Palo Alto Networks, which used its technology to monitor a week's worth of traffic traversing the Internet gateway at 1,636 businesses around the world, mostly at medium to large businesses with at least 2,500 users. The eighth version of the resulting report, published every six months, came out this week.

"The key point is that this is real network traffic, it's not a survey. It's not speculation on anyone's part," said Matt Keil, Palo Alto senior research analyst.

We spoke with Palo Alto prior to today's news that Megaupload.com was taken down by the FBI, with the Justice Department unsealing an indictment that charges seven people associated with the site with "widespread online copyright infringement." We were planning to report on the data anyway—and today's news makes it even more interesting.

Megaupload usage was found on the networks of 57 percent of the 1,636 organizations in the study. That's quite a bit less than the 76 percent of networks with Dropbox traffic, and equal to the 57 percent of networks that have Box.net traffic. However, in terms of bandwidth, Megaupload accounted for 20,405 gigabytes, compared to 17,573 for Dropbox and just 86 gigabytes for the business-focused Box.net. The Dropbox numbers, indicating lots of traffic but a smaller average file size, suggest a mix of personal and work usage. Another consumer-oriented service accounting for a chunk of traffic was Filesonic, which appeared on 52 percent of networks and consumed 4,058 gigabytes.

Overall, Palo Alto tracked 76,225 gigabytes worth of traffic being used up by some 65 browser-based file sharing applications (including Dropbox, even though the Dropbox service can be used outside the browser). Counting only Web-based file-sharing, then, Megaupload accounted for more than a quarter of corporate traffic.

However, Web-based file sharing is still just a small part of overall Internet usage in corporations. Looking at all types of applications and use cases, Palo Alto found 10.9 million gigabytes of consumption across the 1,636 companies. In fact, the BitTorrent peer-to-peer service alone accounted for much more traffic than all browser-based file-sharing applications combined, with 177,513 gigabytes of bandwidth consumed, or less than 2 percent of all corporate Internet traffic.

Proportionally, BitTorrent and Megaupload likely have a much greater share of the Internet as a whole than they do in corporate networks. One previous study by Envisional pegged BitTorrent as taking up 13.5 percent of peak bandwidth usage in the US and 28.4 percent in Europe, and also said downloads from cyberlocker sites such as Megaupload, Rapidshare and HotFile take up 7 percent of all Internet traffic.

Still, when Palo Alto reports back to customers on the usage of Web-based file sharing, the reaction is usually "I knew I had some of these applications on my network, but I didn't realize I had so many," Keil said.

Although Dropbox seems to straddle the line between personal and business use, in most cases there's usually a clear distinction between "tools that help me get my job done and tools that help us stay entertained," with business-focused services usually transferring smaller files, Keil said. Yousendit, for example, is mostly used for productivity and was found in 51 percent of networks, but accounted for just 423 gigabaytes.

Megaupload clocks in with big numbers because of the types of files being shared. "Of the top-20 file downloads found on December 5th, 2011, six of the files were software applications, eight were games or game demos, and six were movie trailers," the Palo Alto report states.

Interestingly, Tor client software for encrypting a user's traffic was found on 13 percent of corporate networks. Palo Alto didn't detail this usage in its report because of how low it was, accounting for 0.077 percent of bandwidth. Companies with a Tor presence might have it on just one or two machines. But certainly, it's something any IT security pro will want to locate and get rid of.

Tor "is not really that trivial of a tool to use," said Wade Williamson, Palo Alto senior security analyst. "Tor is kind of a pre-requisite tool if you're going to be a hacker. If I'm going to attack someone's network i'm definitely going to use Tor or something like it so people can't follow my footsteps and see where they come from." Palo Alto's research didn't determine what exactly people were using Tor to do. "It's hard to say if they're hackers," Wade said. "Someone could have heard this is the best way to anonymize yourself. We're not saying all these are hackers, but there is definitely a security issue there."

It turns out that Tor's presence has remained steady in the 13 to 14 percent range in all of Palo Alto's previous reports, the company said. Megaupload traffic also hasn't changed much recently. But it will, if the site stays shut down for long.